🚀 Advanced Network Stress-Testing in C#

SYN Flood & UDP Flood with Random Source IP and MAC

Simulate DDoS/DoS Attacks for Penetration Testing (Linux, C#, Raw Sockets)

⚠️ Legal Disclaimer

This content is for educational and authorized security assessment purposes only.

Do NOT run these tools on networks or systems without explicit written authorization.

Misuse can result in severe legal consequences.

You are solely responsible for your actions.

🧩 Project Overview

This gist provides two advanced C# tools for simulating high-impact network flood attacks:

SYN Flood: Floods a target with randomized TCP SYN packets.
UDP Flood: Floods a target with randomized UDP datagrams.

Both tools feature:

Randomized source IPs (spoofed packets)
Randomized source MAC addresses (Ethernet layer spoofing)
Full custom construction of Ethernet, IP, and TCP/UDP headers.
Linux-only support, using raw AF_PACKET sockets for maximum realism.

🖼️ How It Works — At a Glance

flowchart LR
    Attacker["C# Raw Socket Tool"]
    Randomize["Random<br>MAC & IP"]
    Target["Target Server/Switch"]
    Attacker -- "Ethernet Frame (random MAC, random IP)" --> Randomize
    Randomize -- "Packets" --> Target

Each packet sent has a new, random source MAC and IP address.
Network appliances are stress-tested at both Layer 2 (MAC) and Layer 3 (IP).

📦 Features Table

Feature	SYN Flood	UDP Flood
Custom Ethernet (MAC) Header	✅	✅
Custom IP Header (Random IP)	✅	✅
Custom TCP/UDP Header	✅ (SYN only)	✅
Works on Linux (AF_PACKET)	✅	✅
Requires root privileges	✅	✅
Windows support	❌ (Linux only)	❌ (Linux only)
Fully open-source	✅	✅

✨ Why Randomize Source IP & MAC?

Bypass basic anti-DDoS rules: Simulates a global botnet.
Test network-level defense devices: Switches, firewalls, and routers.
Evaluate real-world readiness: Most tools only randomize IP; this stack attacks at both Ethernet and IP layers.

🛠️ Usage Example

1️⃣ SYN Flood

sudo mono SynFloodWithRandomMAC.exe eth0 192.168.1.100 80

eth0 — your network interface
192.168.1.100 — target IP address
80 — target port (e.g., web server)

2️⃣ UDP Flood

sudo mono UdpFloodWithRandomMAC.exe eth0 192.168.1.100 53

53 — target UDP port (e.g., DNS)

🔬 How Does the Code Work?

Ethernet Frame Construction

Randomly generates a source MAC for every packet:
```
byte[] srcMAC = RandomMac();
```

Sets broadcast or specific destination MAC:

Buffer.BlockCopy(dstMAC, 0, eth, 0, 6);
Buffer.BlockCopy(srcMAC, 0, eth, 6, 6);
eth[12] = 0x08; eth[13] = 0x00; // EtherType = IPv4

IP Header Construction

Randomly generates a valid source IP:
```
byte[] srcIP = RandomIP();
```
Sets all header fields (version, length, protocol, etc.), and calculates IP checksum.

TCP/UDP Header Construction

SYN Flood: Sends TCP SYN packets with randomized source port.
UDP Flood: Sends UDP datagrams with randomized source port.

Sending the Packet

Uses Linux AF_PACKET raw socket:

Socket s = new Socket(AddressFamily.Packet, SocketType.Raw, (ProtocolType)0x0003);
s.SendTo(pkt, 0, pkt.Length, SocketFlags.None, new SockAddr(addr));

🧑‍💻 Sample Output

[INFO] Sending SYN flood to 192.168.1.100:80 on eth0
[INFO] Random Source MAC: d2:b1:7f:4a:11:23, Source IP: 7.8.132.22
[INFO] Random Source MAC: 0a:fd:ac:db:22:ff, Source IP: 210.65.2.150
...

💻🔗 Full Source Code

▶️ SYN Flood with Random MAC & IP `SynFloodWithRandomMAC_Version17.cs` _{• C# source code • Randomizes MAC & IP • TCP SYN flood}	▶️ UDP Flood with Random MAC & IP `UdpFloodWithRandomMAC_Version17.cs` _{• C# source code • Randomizes MAC & IP • UDP flood}
▶️ SYN Flood Ethernet Ultra `SynFloodEthernet_Ultra_Version4.cs` _{• C# source code • Ethernet SYN flood • Advanced randomization • Multi-protocol support}	▶️ SYN Flood Ethernet Ultra (V5) `SynFloodEthernetUltra_Version5.cs` _{• C# source code • Ethernet SYN flood • Ultra advanced randomization • Multi-protocol, multi-target, Prometheus}

---

💬 FAQ

Q: Can I use this on Windows?
A: No. Windows does not support sending Ethernet frames with custom MACs from user-space C#.

Q: Does it work in a VM?
A: Only if the VM’s network is set to “bridged” and the hypervisor allows raw Ethernet frames.

Q: Can I use this for real DDoS?
A: Absolutely not. This is for authorized testing only.

🛡️ Recommendations for Safe Testing

Always have explicit written permission.
Test in isolated, controlled lab environments.
Monitor the target’s health and network congestion.
Use Wireshark/tcpdump to verify spoofed packets.

📚 Further Reading

🏁 Contribute

Feel free to fork and contribute improvements, such as:

IPv6 support
Rate limiting
Enhanced reporting

🧑‍🔬 Author

Developed by 𝙈𝒊𝙘𝒉𝙚𝒍𝙚-𝙏𝒏 for internal security audits and educational purposes.

michele-tn/Advanced Network Stress-Testing in C#.md